[PATCH proxmox v3 08/23] notify: smtp: Add XOAUTH2 authentication support

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Extend the transport building logic to authenticate via XOAUTH2 if
configured, and manage the related state updates.

Previously, the authentication method was determined based on the
presence of a password in the config. In order to ensure backwards
compatibility with older configurations, add an `auth_method` method
ensuring configurations that used PLAIN auth before this series
continue to do so without having to set it explicitly.

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
Reviewed-by: Lukas Wagner <l.wagner@proxmox.com>
---
 proxmox-notify/src/endpoints/smtp.rs | 96 ++++++++++++++++++++++++----
 1 file changed, 83 insertions(+), 13 deletions(-)

diff --git a/proxmox-notify/src/endpoints/smtp.rs b/proxmox-notify/src/endpoints/smtp.rs
index 3e7175d2..45513cd7 100644
--- a/proxmox-notify/src/endpoints/smtp.rs
+++ b/proxmox-notify/src/endpoints/smtp.rs
@@ -3,11 +3,12 @@ use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 use lettre::message::header::{HeaderName, HeaderValue};
 use lettre::message::{Mailbox, MultiPart, SinglePart};
+use lettre::transport::smtp::authentication::{Credentials, Mechanism};
 use lettre::transport::smtp::client::{Tls, TlsParameters};
 use lettre::{message::header::ContentType, Message, SmtpTransport, Transport};
 use oauth2::{ClientId, ClientSecret, RefreshToken};
 use serde::{Deserialize, Serialize};
-use tracing::info;
+use tracing::{debug, info};
 
 use proxmox_schema::api_types::COMMENT_SCHEMA;
 use proxmox_schema::{api, Updater};
@@ -200,7 +201,7 @@ pub struct SmtpPrivateConfig {
     pub oauth2_client_secret: Option<String>,
 }
 
-/// A sendmail notification endpoint.
+/// A SMTP notification endpoint.
 pub struct SmtpEndpoint {
     pub config: SmtpConfig,
     pub private_config: SmtpPrivateConfig,
@@ -244,22 +245,91 @@ impl SmtpEndpoint {
         }
     }
 
+    /// Infer the auth method based on the presence of a password field in the private config.
+    ///
+    /// This is required for backwards compatibility for configs created before the `auth_method`
+    /// field was added, i.e., the presence of a password implicitly meant plain authentication
+    /// was to be used.
+    fn auth_method(&self) -> Option<SmtpAuthMethod> {
+        self.config.auth_method.or_else(|| {
+            if self.private_config.password.is_some() {
+                Some(SmtpAuthMethod::Plain)
+            } else {
+                None
+            }
+        })
+    }
+
+    /// Build an [`SmtpTransport`].
+    ///
+    /// If OAuth2 authentication is configured, this method will additionally load,
+    /// update and store the OAuth2-related state for this endpoint.
     fn build_transport(&self, tls: Tls, port: u16) -> Result<SmtpTransport, Error> {
-        let mut transport_builder = SmtpTransport::builder_dangerous(&self.config.server)
+        let transport_builder = SmtpTransport::builder_dangerous(&self.config.server)
             .tls(tls)
             .port(port)
             .timeout(Some(Duration::from_secs(SMTP_TIMEOUT.into())));
 
-        if let Some(username) = self.config.username.as_deref() {
-            if let Some(password) = self.private_config.password.as_deref() {
-                transport_builder = transport_builder.credentials((username, password).into());
-            } else {
-                return Err(Error::NotifyFailed(
-                    self.name().into(),
-                    Box::new(Error::Generic(
-                        "username is set but no password was provided".to_owned(),
-                    )),
-                ));
+        let transport_builder = match &self.auth_method() {
+            None => transport_builder,
+            Some(SmtpAuthMethod::Plain) => match (
+                self.config.username.as_deref(),
+                self.private_config.password.as_deref(),
+            ) {
+                (Some(username), Some(password)) => {
+                    transport_builder.credentials((username, password).into())
+                }
+                (Some(_), None) => {
+                    return Err(Error::NotifyFailed(
+                        self.name().into(),
+                        Box::new(Error::Generic(
+                            "username is set but no password was provided".to_owned(),
+                        )),
+                    ))
+                }
+                _ => transport_builder,
+            },
+            Some(method) => {
+                let state = context().load_oauth_state(self.name())?;
+
+                let refresh_token =
+                    state
+                        .oauth2_refresh_token
+                        .clone()
+                        .ok_or(Error::NotifyFailed(
+                            self.name().into(),
+                            Box::new(Error::Generic("no refresh token found".into())),
+                        ))?;
+
+                debug!(
+                    "requesting OAuth2 access token for endpoint '{}'",
+                    self.config.name
+                );
+
+                let token_exchange_result = self.get_access_token(&refresh_token, method)?;
+
+                let state = state
+                    .set_oauth2_refresh_token(Some(
+                        token_exchange_result
+                            .refresh_token
+                            .map(|t| t.into_secret())
+                            .unwrap_or_else(|| refresh_token),
+                    ))
+                    .set_last_refreshed(proxmox_time::epoch_i64());
+
+                context().save_oauth_state(self.name(), Some(state))?;
+
+                debug!(
+                    "OAuth2 token exchange successful for endpoint '{}'",
+                    self.config.name
+                );
+
+                transport_builder
+                    .credentials(Credentials::new(
+                        self.config.from_address.to_owned(),
+                        token_exchange_result.access_token.into_secret(),
+                    ))
+                    .authentication(vec![Mechanism::Xoauth2])
             }
         };
 
-- 
2.47.3